A new branch WAN Edge shows no OMP routes, and the operations team reports the control connection to the SD-WAN Controller flaps between challenge and tear-down even though the Validator is reachable. Authentication was recently changed. Which interpretation of the control connection states should guide the next troubleshooting step for control plane connectivity?
Select an answer to reveal the explanation.
Short Explanation
You read the states like clues, not just colors. Challenge then teardown is a failed handshake at the door, so double-check authentication details.
Full Explanation
On a WAN Edge, control states progress from connect to challenge during certificate exchange and mutual authentication with the SD-WAN Controller (formerly vSmart) after Validator (formerly vBond) orchestration, and tear-down indicates the session was actively rejected or torn down due to failed authentication, organization mismatch or allowlist rejection. A reachable Validator shows that IP reachability and the first handshake work, so the failure points to trust failing at the Controller. Treating it as transport congestion misses that the Validator is reachable over the same path and bandwidth does not cause challenge failures. Treating it as software incompatibility would typically affect broader peering and show version errors, not isolated challenge cycling after an authentication change. Treating it as missing OMP policy confuses route advertisement, which occurs only after control is established, not during authentication. Exam caveat: map connect, challenge, up and tear-down in order to isolate reachability versus trust versus policy. Practical check: run show sdwan control connection-history and compare certificate, organization and allowlist entries.